@Flyslinger2 wrote:
Current federal customer is not happy with my mentioning this to them. All they can see is more intrusion into their project, higher costs, and more delays.
Not well met where the rubber meets the road. Not surprised. "Whats wrong with business as usual?"
Mark, et al.,
The standard benchmark priorities for most projects, and especially government acquisitions, are described by the three-legged stool of Cost, Schedule, and Performance. While the training materials and reference documents use language and illustrations trying to present those three as co-equal, in reality they never are. My observation has been that Cost is most often dominant over both schedule and performance. Occasionally, Schedule assumes dominance, especially when an agency head has personally promised a completion date in public testimony to one or more committees of Congress. I have never seen Performance be the dominant concern in the triad.
When either cost or schedule are threatened, the solution is generally to reduce the performance requirements. Secondary requirements, not directly related to mission performance, tend to be loosened first, then direct mission performance functions. Security and privacy requirements fall under the Performance group, and are almost always secondary to mission. Thus, those security and privacy requirements get redefined as "desirements" and are discounted.
The only path I have figured out on how to overcome the attitude Mark described is to show clearly and concretely how failure to meet directed security capabilities will negatively impact both Cost and Schedule by delaying system authorization (Schedule) when the first system assessment is failed and adding post-production Cost to go back and bolt on the security features that should have been built in in the first place.
Enjoy!
